RealNetworks Helix Server DataConvertBuffer Heap Overflow Vulnerability

ID ZDI-08-090
Type zdi
Reporter Anonymous
Modified 2008-06-22T00:00:00


This vulnerability allows attackers to execute arbitrary code on vulnerable installations of RealNetworks Helix Server. Authentication is not required to exploit this vulnerability. The specific flaw exists while processing malformed base64 encoded data from a SET_PARAMETER command containing the DataConvertBuffer header within an RTSP packet. The service fails to check that the data was properly decoded. The process then uses a faulty return value as a size parameter leading to an exploitable heap based buffer overflow. Exploitation of this vulnerability allows an attacker to execute arbitrary code under the context of the SYSTEM user.